Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability
• Software Link:
• Affected Versions:
Version 25.100.300 and prior versions.
• Vulnerability Description:
The vulnerability is located within the “Translate Module”, which allows users to upload and extract archive files into a temporary directory. However, the application fails to properly verify the contents of these archives before extracting them. This can be exploited by malicious users to upload and execute arbitrary PHP code by including a PHP file along with a specially crafted .htaccess file within the archive.
Successful exploitation of this vulnerability requires an account with “SOURCE” and “WRITE” permissions for the “Translate Module”.
• Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2025-67886.php
• Solution:
No official solution is currently available.
• Disclosure Timeline:
[22/10/2025] – Vendor notified, no response
[03/11/2025] – Vendor contacted again, no response
[12/11/2025] – CVE identifier requested
[12/12/2025] – CVE identifier assigned
[15/12/2025] – Public disclosure
• CVE Reference:
The Common Vulnerabilities and Exposures program (cve.org) has assigned the name CVE-2025-67886 to this vulnerability.
• Credits:
Vulnerability discovered by Egidio Romano.